SSH Hardening to Version 2

Bundle lab · $29.99

Harden the management-plane SSH service on a single Cisco IOS router so only SSHv2 is permitted and session limits are tightened. The baseline lab already has working SSH. You will enforce SSH version 2, set a 60-second authentication timeout, and limit authentication retries to 2. You will also regenerate a 2048-bit RSA key (an exec-only step) and validate with show commands.

Learning objectives

• Enforce SSHv2-only access on Cisco IOS (ip ssh version 2)
• Tighten SSH session parameters (authentication timeout and retries)
• Regenerate a 2048-bit RSA host key from exec mode
• Verify SSH state and parameters with show ip ssh
• Explain why SSHv2 and 2048-bit keys mitigate weaknesses of SSHv1 and short moduli

Troubleshooting focus

• If show ip ssh is empty or disabled, confirm an RSA key exists and VTY permits SSH
• RSA key generation fails without both a non-default hostname and ip domain-name
• If SSH sessions hang, check ip ssh time-out and authentication-retries values
• Ensure line vty uses transport input ssh and a working login method (login local or AAA)